@cosmicdrift/kumiko-framework 0.373.0 → 0.377.0

package/dist/engine/build-app-schema.js

@@ -27,6 +27,7 @@ import { ZodObject } from "zod";
 import { collectUrlPrefillFieldsByScreenQn } from "./boot-validator/url-prefill-fields.js";
 import { buildConfigFeatureSchema, SETTINGS_HUB_FEATURE, } from "./build-config-feature-schema.js";
 import { isEncryptedAtRest } from "./config-helpers.js";
+import { isListQueryWithoutSearchableFields } from "./entity-list-searchability.js";
 import { QnTypes, qualifyEntityName } from "./qualified-name.js";
 export function buildAppSchema(registry, options = {}) {
     const features = [];
@@ -341,11 +342,14 @@ function projectConfigEditScreen(screen, encryptedConfigKeyQns) {
     return fields === undefined ? screen : { ...screen, fields };
 }
 function projectProjectionListScreen(screen, registry) {
-    const schema = registry.getQueryHandler(screen.query)?.schema;
-    const capabilities = deriveProjectionListCapabilities(schema);
+    const handler = registry.getQueryHandler(screen.query);
+    const capabilities = deriveProjectionListCapabilities(handler?.schema);
+    // A search box over an entity without searchable fields would never match.
+    const searchable = capabilities.searchable &&
+        !isListQueryWithoutSearchableFields(screen.query, handler, (name) => registry.getEntity(name));
     return {
         ...screen,
-        searchable: screen.searchable ?? capabilities.searchable,
+        searchable: screen.searchable ?? searchable,
         sortable: capabilities.sortable,
         paginated: capabilities.paginated,
     };

package/dist/engine/entity-list-searchability.d.ts

@@ -0,0 +1,5 @@
+import type { EntityDefinition, QueryHandlerDef } from "./types/index.ts";
+export declare function resolveEntityBehindListQuery(queryQn: string, handler: QueryHandlerDef | undefined, lookupEntity: (entityName: string) => EntityDefinition | undefined): EntityDefinition | undefined;
+/** True when the list query is an entity-convention one over an entity with no
+ *  searchable field — a search box would never match anything. */
+export declare function isListQueryWithoutSearchableFields(queryQn: string, handler: QueryHandlerDef | undefined, lookupEntity: (entityName: string) => EntityDefinition | undefined): boolean;

package/dist/engine/entity-list-searchability.js

@@ -0,0 +1,35 @@
+import { ENTITY_CONVENTION_QUERY_BRAND } from "@cosmicdrift/kumiko-types/handlers";
+import { parseQn } from "./qualified-name.js";
+// Mirrors buildSearchableSortableCaches (registry-validate.ts): a `search`
+// payload only matches text fields, embedded sub-fields and references that
+// opted in with `searchable: true`.
+function entityHasSearchableField(entity) {
+    return Object.values(entity.fields).some((field) => {
+        if (field.type === "embedded") {
+            return Object.values(field.schema).some((subField) => subField.searchable === true);
+        }
+        return (field.type === "text" || field.type === "reference") && field.searchable === true;
+    });
+}
+// Entity-convention list queries (ENTITY_CONVENTION_QUERY_BRAND) carry no
+// entity on the handler; the entity name is recovered from the query QN's
+// `<entityName>:list` naming convention. Hand-written handlers resolve to
+// undefined — "capability unknown, no throw".
+export function resolveEntityBehindListQuery(queryQn, handler, lookupEntity) {
+    if (handler === undefined || handler[ENTITY_CONVENTION_QUERY_BRAND] !== true)
+        return undefined;
+    let entityName;
+    try {
+        entityName = parseQn(queryQn).name.split(":")[0] ?? "";
+    }
+    catch {
+        return undefined;
+    }
+    return entityName === "" ? undefined : lookupEntity(entityName);
+}
+/** True when the list query is an entity-convention one over an entity with no
+ *  searchable field — a search box would never match anything. */
+export function isListQueryWithoutSearchableFields(queryQn, handler, lookupEntity) {
+    const entity = resolveEntityBehindListQuery(queryQn, handler, lookupEntity);
+    return entity !== undefined && !entityHasSearchableField(entity);
+}

package/dist/engine/feature-ui-extensions.js

@@ -31,9 +31,12 @@ function qualifySelectorPanel(featureName, panel) {
             throw new Error(`[Feature ${featureName}] extensionSelector screen panel "${panel.id}" must not set a label — ` +
                 `the settings dashboard has no i18n namespace for it; the embedded screen carries its own title.`);
         }
-        if (panel.screen === "" || isValidQn(panel.screen))
+        const qualify = (ref) => ref === "" || isValidQn(ref) ? ref : qualifyEntityName(featureName, "screen", ref);
+        const screen = qualify(panel.screen);
+        const fallback = panel.fallback === undefined ? undefined : qualify(panel.fallback);
+        if (screen === panel.screen && fallback === panel.fallback)
             return panel;
-        return { ...panel, screen: qualifyEntityName(featureName, "screen", panel.screen) };
+        return { ...panel, screen, ...(fallback !== undefined && { fallback }) };
     }
     throw new Error(`[Feature ${featureName}] extensionSelector panel ${JSON.stringify(panel)} has an unsupported kind — ` +
         `only "custom" and "screen" panels are allowed.`);

package/dist/engine/index.d.ts

@@ -51,11 +51,13 @@ export { i18nKey } from "./i18n-key.ts";
 export { buildSessionRoles, findForbiddenMembershipRole, isForbiddenMembershipRole, stripForbiddenMembershipRoles, } from "./membership-roles.ts";
 export type { OwnershipClause, OwnershipMap, OwnershipRef, OwnershipRule } from "./ownership.ts";
 export { buildOwnershipClause, combineClauses, from, normalizeAccessEntry, userCanCreateFieldRow, userCanReadFieldRow, userCanWriteFieldRow, } from "./ownership.ts";
+export { type PagedListRequest, type PagedListRowValue, pagedListSchema, pageRows, } from "./paged-list.ts";
 export type { ParsedRefTarget } from "./parse-ref-target.ts";
 export { parseRefTarget, parseRefTargetEntityName } from "./parse-ref-target.ts";
 export { buildPipelineSteps, stepsPipeline } from "./pipeline.ts";
 export { projectAppSchemaForRoles } from "./project-app-schema-for-roles.ts";
 export { defineApply, defineMspApply, setFields } from "./projection-helpers.ts";
+export { providerPluginContextFromHandler, providerPluginContextFromJob, } from "./provider-plugin-context.ts";
 export type { BuiltinQnType, ParsedQn, QnType } from "./qualified-name.ts";
 export { isValidQn, parseQn, QnTypes, qn, toKebab } from "./qualified-name.ts";
 export { readClaim } from "./read-claim.ts";
@@ -83,7 +85,7 @@ export { assertNotificationVariables, templateVariable, templateVariablesToZod,
 export { type EffectiveFeaturesResolver, findTierResolverUsage, isTierResolverPlugin, requireTierResolverPlugin, TENANT_TIER_RESOLVER_EXT, type TierResolverPlugin, type TrialGate, } from "./tier-resolver-extension.ts";
 export { findOverDeepTransferChain, resolveTransferAdjacency as resolveEntityTransferAdjacency, type TransferAdjacency, type TransferEdge, type TransferEdgeLink, } from "./transfer-adjacency.ts";
 export { isSystemTenant, isUuid, parseTenantId, SYSTEM_TENANT_ID } from "./types/identifiers.ts";
-export type { AccessRule, ActionFormScreenDefinition, ActiveMembership, ActiveMembershipRejection, ActiveMembershipResult, AgentExposure, AgentHandlerHints, AgentRisk, AppContext, AppendEventArgs, AppendEventFn, AuthClaimsContext, AuthClaimsFn, AuthClaimsHookDef, BeforeTransactionPhase, BeforeTransactionResult, BelongsToRelation, BigIntFieldDef, BooleanFieldDef, BootOptionName, CamelToKebab, ChatSendFailureCode, ClaimKeyDefinition, ClaimKeyHandle, ClaimKeyJsType, ClaimKeyType, ConcurrencyMode, ConfigAccessor, ConfigAccessorFactory, ConfigBacking, ConfigCascade, ConfigCascadeLevel, ConfigDefinition, ConfigEditScreenDefinition, ConfigKeyAccess, ConfigKeyDefinition, ConfigKeyHandle, ConfigKeyType, ConfigMask, ConfigResolver, ConfigScope, ConfigSecretsReader, ConfigSeedDef, ConfigStoredRow, ConfigStoredRowWithSource, ConfigValidateContext, ConfigValidateFn, ConfigValue, ConfigValueSource, ConfigValueWithSource, ContentCollectionDefinition, CreateSeedOptions, CreateTenantSeedOptions, CreateUserSeedOptions, CustomScreenDefinition, CustomScreenRoute, DashboardChartPanel, DashboardCustomPanel, DashboardDateParam, DashboardFeedPanel, DashboardFilterDefinition, DashboardI18nText, DashboardListPanel, DashboardMoneyParam, DashboardPanelDefinition, DashboardPanelVisibility, DashboardProgressListPanel, DashboardScreenDefinition, DashboardScreenPanel, DashboardStatGroupPanel, DashboardStatPanel, DashboardText, DashboardTextParam, DashboardValueFormat, DateFieldDef, DecimalFieldDef, DeleteContext, DeliveryErrorCode, DeliveryFailureCode, DeliverySkipReason, DeriveContext, DerivedFieldDef, DerivedFieldsMap, DerivedValueType, EditExtensionSection, EditFieldPrefill, EditFieldSpec, EditFieldsSection, EditLayout, EditRelatedListSection, EditSectionSpec, EmbeddedListEditSpec, EntityDefinition, EntityEditAction, EntityEditActionPlacement, EntityEditScreenDefinition, EntityId, EntityListExpandableRow, EntityListScreenDefinition, EntityObjectDefinition, EntityRef, EntityRelations, EscapeHatchAuditSink, EscapeHatchDeclaration, EscapeHatchKind, EscapeHatchReporter, EscapeHatchTarget, EscapeHatchUseEvent, EventDef, ExtensionOptionsArgs, ExtensionOptionsFor, FeatureDefinition, FeatureRegistrar, FieldAccess, FieldCondition, FieldDefinition, FieldFormatRegistry, FieldIconKey, FieldRenderer, FileFieldDef, FilesFieldDef, Findability, FormatSpec, FormWidth, HandlerContext, HasManyRelation, HookDefinition, HookMap, ImageFieldDef, ImagesFieldDef, JobBackoff, JobBackoffStrategy, JobContext, JobDefinition, JobHandlerFn, JobTrigger, JobTriggerEvent, JsonbFieldDef, KumikoEntityTypeMap, KumikoEventTypeMap, KumikoExtensionOptionsMap, KumikoHandlerPayloadMap, KumikoHandlerResultMap, LifecycleHookType, ListColumnSpec, ListFacetSpec, ListPaginationMode, ListSortDir, ListSortSpec, LongTextFindability, ManyToManyRelation, MaxPerTenantOptions, MemberReader, MetricNavigate, MetricSpec, MspErrorMode, MspErrorPolicy, MultiSelectFieldDef, MultiStreamApplyFn, MultiStreamProjectionDefinition, NameOrRef, NavDefinition, NavIconKey, NotificationDataFn, NotificationDefinition, NotificationLocalizedTemplate, NotificationRecipientFn, NotificationRecordMapping, NotificationTemplateBody, NotificationTemplateFn, NotificationTemplateMeta, NotifyDeferred, NotifyDelivery, NotifyDeliveryStatus, NotifyDispatched, NotifyFactory, NotifyFn, NotifyJobDispatcher, NotifyOptions, NotifyPriority, NotifyResult, NumberFieldDef, OnDeleteStrategy, OpenToAllAccessRule, OpenToAllDeclaration, OpenToAllPersonalData, ParentRefDef, PersonalAnnotations, PersonalAnnotationsLongText, PersonalAnnotationsNoFind, PersonalSubject, PlatformComponent, PluralForms, PostDeleteHookFn, PostSaveHookFn, PreDeleteHookFn, PreparedWriteEvent, PreQueryHookFn, PreSaveHookFn, ProjectionDefinition, ProjectionDetailScreenDefinition, ProjectionListScreenDefinition, ProjectionTable, QualifiedEventName, QueryEvent, QueryHandlerDef, QueryHandlerFn, RateLimitPer, RecordHeaderSpec, RecordHeaderSubtitlePart, ReferenceDataDef, Registry, RelationDefinition, ResolvedPiiFlags, RetentionDef, RoleAccessPersonalData, RoleAccessRule, RowAction, RowActionNavigate, RowActionNavigateBase, RowActionWriteHandler, RowFieldExtractor, SaveContext, ScreenDefinition, ScreenFilter, ScreenFilterOp, ScreenNavSugar, ScreenSlots, SecretKeyDefinition, SecretKeyHandle, SecretMintConfirmStep, SecretMintScreenDefinition, SecretNamespaceDefinition, SecretNamespaceHandle, SecretNamespaceOptions, SecretReveal, SecretRevealField, SecretsEditScreenDefinition, SecretsEditSection, SelectFieldDef, SessionUser, SessionUserOrigin, StackBootRequirement, StreamHandlerDef, StreamHandlerFn, Subscribe, TargetRef, TemplateListVariableDef, TemplateScalarVariableDef, TemplateVariableDef, TemplateVariables, TenantId, TenantWriteTarget, TextFieldDef, ToolbarAction, TranslationEntry, TranslationKeys, TranslationsDef, TranslationValue, TreeAction, TreeActionDef, TreeActionsHandle, TreeChildrenSubscribe, TreeNode, TreeNodeState, UnitKey, UnsafeAppendEventFn, ValidationError, ValidationHookFn, WorkspaceDefinition, WriteEvent, WriteHandlerDef, WriteHandlerFn, WriteResult, } from "./types/index.ts";
+export type { AccessRule, ActionFormScreenDefinition, ActiveMembership, ActiveMembershipRejection, ActiveMembershipResult, AgentExposure, AgentHandlerHints, AgentRisk, AppContext, AppendEventArgs, AppendEventFn, AuthClaimsContext, AuthClaimsFn, AuthClaimsHookDef, BeforeTransactionPhase, BeforeTransactionResult, BelongsToRelation, BigIntFieldDef, BooleanFieldDef, BootOptionName, CamelToKebab, ChatSendFailureCode, ClaimKeyDefinition, ClaimKeyHandle, ClaimKeyJsType, ClaimKeyType, ConcurrencyMode, ConfigAccessor, ConfigAccessorFactory, ConfigBacking, ConfigCascade, ConfigCascadeLevel, ConfigDefinition, ConfigEditScreenDefinition, ConfigKeyAccess, ConfigKeyDefinition, ConfigKeyHandle, ConfigKeyType, ConfigMask, ConfigResolver, ConfigScope, ConfigSecretsReader, ConfigSeedDef, ConfigStoredRow, ConfigStoredRowWithSource, ConfigValidateContext, ConfigValidateFn, ConfigValue, ConfigValueSource, ConfigValueWithSource, ContentCollectionDefinition, CreateSeedOptions, CreateTenantSeedOptions, CreateUserSeedOptions, CustomScreenDefinition, CustomScreenRoute, DashboardChartPanel, DashboardCurrencyFormat, DashboardCustomPanel, DashboardDateParam, DashboardFeedPanel, DashboardFilterDefinition, DashboardI18nText, DashboardListPanel, DashboardMoneyParam, DashboardPanelDefinition, DashboardPanelVisibility, DashboardProgressListPanel, DashboardProgressTone, DashboardRecordBinding, DashboardRefresh, DashboardRelativeTimeFormat, DashboardRelativeTimeParam, DashboardScreenDefinition, DashboardScreenPanel, DashboardStatGroupPanel, DashboardStatPanel, DashboardText, DashboardTextBlock, DashboardTextPanel, DashboardTextParam, DashboardValueFormat, DateFieldDef, DecimalFieldDef, DeleteContext, DeliveryErrorCode, DeliveryFailureCode, DeliverySkipReason, DeriveContext, DerivedFieldDef, DerivedFieldsMap, DerivedValueType, EditExtensionSection, EditFieldPrefill, EditFieldSpec, EditFieldsSection, EditLayout, EditRelatedListSection, EditSectionSpec, EmbeddedListEditSpec, EntityDefinition, EntityEditAction, EntityEditActionPlacement, EntityEditScreenDefinition, EntityId, EntityListExpandableRow, EntityListScreenDefinition, EntityObjectDefinition, EntityRef, EntityRelations, EscapeHatchAuditSink, EscapeHatchDeclaration, EscapeHatchKind, EscapeHatchReporter, EscapeHatchTarget, EscapeHatchUseEvent, EventDef, ExtensionOptionsArgs, ExtensionOptionsFor, FeatureDefinition, FeatureRegistrar, FieldAccess, FieldCondition, FieldDefinition, FieldFormatRegistry, FieldIconKey, FieldRenderer, FileFieldDef, FilesFieldDef, Findability, FormatSpec, FormWidth, HandlerContext, HasManyRelation, HookDefinition, HookMap, ImageFieldDef, ImagesFieldDef, JobBackoff, JobBackoffStrategy, JobContext, JobDefinition, JobHandlerFn, JobTrigger, JobTriggerEvent, JsonbFieldDef, KumikoEntityTypeMap, KumikoEventTypeMap, KumikoExtensionOptionsMap, KumikoHandlerPayloadMap, KumikoHandlerResultMap, LifecycleHookType, ListColumnSpec, ListFacetSpec, ListPaginationMode, ListSortDir, ListSortSpec, LongTextFindability, ManyToManyRelation, MaxPerTenantOptions, MemberReader, MetricNavigate, MetricSpec, MspErrorMode, MspErrorPolicy, MultiSelectFieldDef, MultiStreamApplyFn, MultiStreamProjectionDefinition, NameOrRef, NavDefinition, NavIconKey, NotificationDataFn, NotificationDefinition, NotificationLocalizedTemplate, NotificationRecipientFn, NotificationRecordMapping, NotificationTemplateBody, NotificationTemplateFn, NotificationTemplateMeta, NotifyDeferred, NotifyDelivery, NotifyDeliveryStatus, NotifyDispatched, NotifyFactory, NotifyFn, NotifyJobDispatcher, NotifyOptions, NotifyPriority, NotifyResult, NumberFieldDef, OnDeleteStrategy, OpenToAllAccessRule, OpenToAllDeclaration, OpenToAllPersonalData, ParentRefDef, PersonalAnnotations, PersonalAnnotationsLongText, PersonalAnnotationsNoFind, PersonalSubject, PlatformComponent, PluralForms, PostDeleteHookFn, PostSaveHookFn, PreDeleteHookFn, PreparedWriteEvent, PreQueryHookFn, PreSaveHookFn, ProjectionDefinition, ProjectionDetailScreenDefinition, ProjectionListScreenDefinition, ProjectionTable, ProviderPluginContext, QualifiedEventName, QueryEvent, QueryHandlerDef, QueryHandlerFn, RateLimitPer, RecordHeaderSpec, RecordHeaderSubtitlePart, ReferenceDataDef, Registry, RelationDefinition, ResolvedPiiFlags, RetentionDef, RoleAccessPersonalData, RoleAccessRule, RowAction, RowActionNavigate, RowActionNavigateBase, RowActionWriteHandler, RowFieldExtractor, SaveContext, ScreenDefinition, ScreenFilter, ScreenFilterOp, ScreenNavSugar, ScreenSlots, SecretKeyDefinition, SecretKeyHandle, SecretMintConfirmStep, SecretMintScreenDefinition, SecretNamespaceDefinition, SecretNamespaceHandle, SecretNamespaceOptions, SecretReveal, SecretRevealField, SecretsEditScreenDefinition, SecretsEditSection, SelectFieldDef, SessionUser, SessionUserOrigin, StackBootRequirement, StreamHandlerDef, StreamHandlerFn, Subscribe, TargetRef, TemplateListVariableDef, TemplateScalarVariableDef, TemplateVariableDef, TemplateVariables, TenantId, TenantWriteTarget, TextFieldDef, ToolbarAction, TranslationEntry, TranslationKeys, TranslationsDef, TranslationValue, TreeAction, TreeActionDef, TreeActionsHandle, TreeChildrenSubscribe, TreeNode, TreeNodeState, UnitKey, UnsafeAppendEventFn, ValidationError, ValidationHookFn, WorkspaceDefinition, WriteEvent, WriteHandlerDef, WriteHandlerFn, WriteResult, } from "./types/index.ts";
 export { DEFAULT_CURRENCIES, DEFAULT_LOCALES, DELIVERY_FAILURE_CODES, DELIVERY_SKIP_REASONS, HookPhases, HTTP_ERROR_CODE_PATTERN, isAgentVisibleScreen, isDeliveryErrorCode, isOpenToAllGranted, resolveAgentExposure, } from "./types/index.ts";
 export type { AwaitedEventType, PipelineBuildCtx, PipelineCtx, PipelineDef, StepBuilder, StepDef, StepFailureStrategy, StepInstance, StepKind, StepNamespace, StepResolver, } from "./types/step.ts";
 export { runValidation } from "./validation.ts";

package/dist/engine/index.js

@@ -51,10 +51,12 @@ export { i18nKey } from "./i18n-key.js";
 // surface.
 export { buildSessionRoles, findForbiddenMembershipRole, isForbiddenMembershipRole, stripForbiddenMembershipRoles, } from "./membership-roles.js";
 export { buildOwnershipClause, combineClauses, from, normalizeAccessEntry, userCanCreateFieldRow, userCanReadFieldRow, userCanWriteFieldRow, } from "./ownership.js";
+export { pagedListSchema, pageRows, } from "./paged-list.js";
 export { parseRefTarget, parseRefTargetEntityName } from "./parse-ref-target.js";
 export { buildPipelineSteps, stepsPipeline } from "./pipeline.js";
 export { projectAppSchemaForRoles } from "./project-app-schema-for-roles.js";
 export { defineApply, defineMspApply, setFields } from "./projection-helpers.js";
+export { providerPluginContextFromHandler, providerPluginContextFromJob, } from "./provider-plugin-context.js";
 export { isValidQn, parseQn, QnTypes, qn, toKebab } from "./qualified-name.js";
 export { readClaim } from "./read-claim.js";
 export { createRegistry } from "./registry.js";

package/dist/engine/paged-list.d.ts

@@ -0,0 +1,29 @@
+import type { CursorResult } from "@cosmicdrift/kumiko-types/cursor-types";
+import * as z from "zod";
+export type PagedListRowValue = string | number | boolean | null;
+export declare function pagedListSchema<const TSortField extends string>(sortableFields: readonly [TSortField, ...TSortField[]]): z.ZodObject<{
+    limit: z.ZodDefault<z.ZodNumber>;
+    offset: z.ZodOptional<z.ZodNumber>;
+    search: z.ZodOptional<z.ZodString>;
+    sort: z.ZodOptional<z.ZodEnum<{ [k in TSortField]: k; } extends infer T ? { [k in keyof T]: T[k]; } : never>>;
+    sortDirection: z.ZodOptional<z.ZodEnum<{
+        asc: "asc";
+        desc: "desc";
+    }>>;
+    totalCount: z.ZodOptional<z.ZodBoolean>;
+    cursor: z.ZodOptional<z.ZodNever>;
+}, z.core.$strip>;
+export type PagedListRequest<TSortField extends string> = {
+    readonly limit: number;
+    readonly offset?: number | undefined;
+    readonly search?: string | undefined;
+    readonly sort?: TSortField | undefined;
+    readonly sortDirection?: "asc" | "desc" | undefined;
+    readonly totalCount?: boolean | undefined;
+};
+export declare function pageRows<TRow extends Readonly<Record<TSortField, PagedListRowValue>> & {
+    readonly id: string;
+}, TSortField extends string>(rows: readonly TRow[], request: PagedListRequest<TSortField>, options: {
+    readonly searchFields: readonly TSortField[];
+    readonly defaultSort: TSortField;
+}): CursorResult<TRow>;

package/dist/engine/paged-list.js

@@ -0,0 +1,56 @@
+// Search, sort and offset paging for projectionList queries whose rows are
+// assembled in memory (merged from several tables, no single SQL query to
+// page). The projectionList pager sends `offset` + `totalCount`, never a
+// cursor, so `nextCursor` is always null here.
+import * as z from "zod";
+import { MAX_LIST_LIMIT } from "./entity-handlers.js";
+export function pagedListSchema(sortableFields) {
+    return z.object({
+        limit: z.number().int().min(1).max(MAX_LIST_LIMIT).default(50),
+        offset: z.number().int().nonnegative().optional(),
+        search: z.string().optional(),
+        sort: z.enum(sortableFields).optional(),
+        sortDirection: z.enum(["asc", "desc"]).optional(),
+        totalCount: z.boolean().optional(),
+        // Declared so a caller still paging by cursor gets a 400 instead of page one.
+        cursor: z.never({ error: "cursor paging is not supported here; page with offset" }).optional(),
+    });
+}
+function isMissing(value) {
+    return value === null || value === undefined;
+}
+// Missing values sort last in both directions; numbers and booleans compare
+// by value, everything else as a locale-aware string.
+function compareRowValues(a, b, directionMultiplier) {
+    if (isMissing(a) && isMissing(b))
+        return 0;
+    if (isMissing(a))
+        return 1;
+    if (isMissing(b))
+        return -1;
+    if (typeof a === "number" && typeof b === "number")
+        return (a - b) * directionMultiplier;
+    if (typeof a === "boolean" && typeof b === "boolean") {
+        return (Number(a) - Number(b)) * directionMultiplier;
+    }
+    return String(a).localeCompare(String(b)) * directionMultiplier;
+}
+export function pageRows(rows, request, options) {
+    const needle = request.search?.trim().toLowerCase() ?? "";
+    const matching = needle === ""
+        ? rows
+        : rows.filter((row) => options.searchFields.some((field) => String(row[field] ?? "")
+            .toLowerCase()
+            .includes(needle)));
+    const sortField = request.sort ?? options.defaultSort;
+    const directionMultiplier = request.sortDirection === "desc" ? -1 : 1;
+    // The source rows come unordered, so ties fall back to the id; otherwise a
+    // tied row could show up on two pages or on none.
+    const sorted = [...matching].sort((a, b) => compareRowValues(a[sortField], b[sortField], directionMultiplier) || a.id.localeCompare(b.id));
+    const offset = request.offset ?? 0;
+    return {
+        rows: sorted.slice(offset, offset + request.limit),
+        nextCursor: null,
+        ...(request.totalCount === true && { total: matching.length }),
+    };
+}

package/dist/engine/parse-ref-target.js

@@ -5,7 +5,7 @@
 //   - "users:user"  → cross-feature ref (qualifiziert)
 //
 // Lebt im framework-Package damit Server-Validator + Renderer (über
-// Re-Export aus @cosmicdrift/kumiko-headless) denselben Parser nutzen — die
+// Re-Export aus @cosmicdrift/kumiko-renderer/headless) denselben Parser nutzen — die
 // Convention darf nicht zweimal implementiert werden.
 export function parseRefTarget(raw, currentFeature) {
     const idx = raw.indexOf(":");

package/dist/engine/project-app-schema-for-roles.js

@@ -39,8 +39,8 @@
 //     resolves app-wide via a global short-id map, mirroring
 //     resolveRowActionNavigateTarget; kind:"drawer" resolves same-feature
 //     only, mirroring validateDrawerTargetAction)
-//   - projectionDetail header actions + metrics[].navigate
-//   - entityEdit/actionForm/secretMint redirect + actionForm cancelTarget
+//   - projectionDetail and dashboard header actions + projectionDetail metrics[].navigate
+//   - entityEdit/actionForm/secretMint redirect + actionForm successLinks and cancelTarget
 //     (resolveScreenTargetQn: same-feature short id or cross-feature QN)
 //   - dashboard DashboardScreenPanel.screen (resolveScreenTargetQn)
 //   - every EditSectionSpec kind's own `actions` (fields/extension/writeForm/
@@ -418,8 +418,27 @@ function projectHeader(header, indices, keptScreenQns) {
     return changed ? { ...header, subtitle: nextParts } : header;
 }
 function projectDashboardPanels(panels, feature, keptScreenQns) {
-    const kept = panels.filter((p) => p.kind !== "screen" || isScreenTargetKept(feature.featureName, p.screen, keptScreenQns));
-    return kept.length === panels.length ? panels : kept;
+    let changed = false;
+    const kept = [];
+    for (const panel of panels) {
+        if (panel.kind !== "screen") {
+            kept.push(panel);
+        }
+        else if (!isScreenTargetKept(feature.featureName, panel.screen, keptScreenQns)) {
+            changed = true;
+        }
+        else if (panel.fallback !== undefined &&
+            !isScreenTargetKept(feature.featureName, panel.fallback, keptScreenQns)) {
+            // The role cannot reach the stand-in, so the tile just hides.
+            const { fallback: _unreachable, ...withoutFallback } = panel;
+            kept.push(withoutFallback);
+            changed = true;
+        }
+        else {
+            kept.push(panel);
+        }
+    }
+    return changed ? kept : panels;
 }
 // --- per-screen-type projection ---
 function projectListScreenId(listScreenId, indices, keptScreenQns) {
@@ -512,12 +531,15 @@ function projectEntityEditScreen(screen, feature, indices, keptScreenQns) {
     };
 }
 function projectActionFormScreen(screen, feature, indices, keptScreenQns) {
-    const { redirect, cancelTarget, layout, listScreenId, ...rest } = screen;
+    const { redirect, successLinks, cancelTarget, layout, listScreenId, ...rest } = screen;
     const nextRedirect = projectRedirect(feature.featureName, redirect, keptScreenQns);
+    const keptSuccessLinks = successLinks?.filter((link) => isRedirectTargetKept(feature.featureName, link, keptScreenQns));
+    const nextSuccessLinks = keptSuccessLinks?.length === 0 ? undefined : keptSuccessLinks;
     const nextCancelTarget = projectCancelTarget(feature.featureName, cancelTarget, keptScreenQns);
     const nextLayout = projectEditLayout(layout, feature, indices, keptScreenQns);
     const nextListScreenId = projectListScreenId(listScreenId, indices, keptScreenQns);
     const unchanged = nextRedirect === redirect &&
+        nextSuccessLinks?.length === successLinks?.length &&
         nextCancelTarget === cancelTarget &&
         nextLayout === layout &&
         nextListScreenId === listScreenId;
@@ -527,6 +549,7 @@ function projectActionFormScreen(screen, feature, indices, keptScreenQns) {
         ...rest,
         layout: nextLayout,
         ...(nextRedirect !== undefined && { redirect: nextRedirect }),
+        ...(nextSuccessLinks !== undefined && { successLinks: nextSuccessLinks }),
         ...(nextCancelTarget !== undefined && { cancelTarget: nextCancelTarget }),
         ...(nextListScreenId !== undefined && { listScreenId: nextListScreenId }),
     };
@@ -565,8 +588,16 @@ function projectScreen(screen, feature, indices, keptScreenQns) {
         case "projectionDetail":
             return projectProjectionDetailScreen(screen, feature, indices, keptScreenQns);
         case "dashboard": {
+            const { actions, ...rest } = screen;
             const nextPanels = projectDashboardPanels(screen.panels, feature, keptScreenQns);
-            return nextPanels === screen.panels ? screen : { ...screen, panels: nextPanels };
+            const nextActions = projectRowActionArray(actions, feature, indices, keptScreenQns);
+            if (nextPanels === screen.panels && nextActions === actions)
+                return screen;
+            return {
+                ...rest,
+                panels: nextPanels,
+                ...(nextActions !== undefined && { actions: nextActions }),
+            };
         }
         case "entityEdit":
             return projectEntityEditScreen(screen, feature, indices, keptScreenQns);

package/dist/engine/provider-plugin-context.d.ts

@@ -0,0 +1,3 @@
+import type { HandlerContext, JobContext, ProviderPluginContext } from "@cosmicdrift/kumiko-types/handlers";
+export declare function providerPluginContextFromHandler(ctx: HandlerContext): ProviderPluginContext;
+export declare function providerPluginContextFromJob(ctx: JobContext): ProviderPluginContext;

package/dist/engine/provider-plugin-context.js

@@ -0,0 +1,28 @@
+export function providerPluginContextFromHandler(ctx) {
+    return {
+        db: ctx.db,
+        dbOutsideTransaction: ctx.dbOutsideTransaction,
+        systemDb: ctx.systemDb,
+        registry: ctx.registry,
+        user: ctx.user,
+        log: ctx.log,
+        triggeredBy: ctx.triggeredBy,
+        config: ctx.config,
+        secrets: ctx.secrets,
+    };
+}
+// Jobs have no request user: the job's system user is the acting identity, and no
+// outside-transaction handle exists because jobs never run inside the handler's tx.
+export function providerPluginContextFromJob(ctx) {
+    return {
+        db: ctx.db,
+        dbOutsideTransaction: undefined,
+        systemDb: ctx.systemDb,
+        registry: ctx.registry,
+        user: ctx.systemUser,
+        log: ctx.log,
+        triggeredBy: ctx.triggeredBy,
+        config: ctx.config,
+        secrets: ctx.secrets,
+    };
+}

package/dist/engine/schema-builder.js

@@ -4,6 +4,7 @@ import { isValidIanaTimeZone } from "../time/index.js";
 import { assertUnreachable } from "../utils/index.js";
 import { withDerivedCells } from "./embedded-derived.js";
 import { DEFAULT_CURRENCIES } from "./types/index.js";
+const MONTH_PATTERN = /^\d{4}-(0[1-9]|1[0-2])$/;
 // True if `n` carries at most `scale` decimal places. A relative epsilon
 // tolerates float artifacts (`0.1 + 0.2 = 0.30000000000000004` is accepted at
 // scale 2) — the exact `toFixed`-roundtrip-equality it replaces rejected such
@@ -106,6 +107,12 @@ export function fieldToZod(field, currencies, opts = {}) {
                 schema = schema.email();
             if (field.format === "url")
                 schema = schema.url();
+            if (field.format === "month") {
+                // "" stays valid for an optional field; `required` rejects it via min(1) below.
+                schema = schema.refine((value) => value === "" || MONTH_PATTERN.test(value), {
+                    message: "expected a month as YYYY-MM",
+                });
+            }
             if (field.required)
                 schema = schema.min(1);
             return field.default !== undefined && applyDefaults ? schema.default(field.default) : schema;

package/dist/engine/types/index.d.ts

@@ -7,7 +7,7 @@ export type { ExtensionOptionsArgs, ExtensionOptionsFor, KumikoExtensionOptionsM
 export type { BootCheckContext, BootCheckFn, BootOptionName, EntityObjectDefinition, FeatureDefinition, FeatureMetricDef, FeatureMetricType, FeatureRegistrar, HookDefinition, MetricOptions, Registry, SecretKeyDefinition, SecretKeyHandle, SecretNamespaceDefinition, SecretNamespaceHandle, SecretNamespaceOptions, SecretOptions, StackBootRequirement, StoreTableDef, StoreTableEntry, StoreTableOptions, UiHintOption, UiHints, } from "@cosmicdrift/kumiko-types/feature";
 export type { FieldIconKey } from "@cosmicdrift/kumiko-types/field-icon";
 export type { AnyFileFieldDef, BigIntFieldDef, BooleanFieldDef, ClientDerivedFieldDef, DateFieldDef, DecimalFieldDef, DefaultCurrency, DeriveContext, DerivedFieldDef, DerivedFieldsMap, DerivedValueType, EmbeddedDerivedCellDef, EmbeddedFieldDef, EmbeddedSubFieldDef, EntityDefinition, EntityEventMigration, EntityIndexDef, FieldAccess, FieldDefinition, FieldsMap, FileFieldDef, FilesFieldDef, Findability, ImageFieldDef, ImagesFieldDef, JsonbFieldDef, LocatedTimestampFieldDef, LongTextFieldDef, LongTextFindability, MoneyCurrencySource, MoneyFieldDef, MultiSelectFieldDef, NumberFieldDef, OptionsQueryPayload, OptionsQueryPayloadValue, ParentRefDef, PersonalAnnotations, PersonalAnnotationsLongText, PersonalAnnotationsNoFind, PersonalSubject, ReferenceFieldDef, ResolvedPiiFlags, RetentionDef, SelectFieldDef, SelectOptionTone, TextFieldDef, TimestampFieldDef, TransitionMap, TzFieldDef, } from "@cosmicdrift/kumiko-types/fields";
-export type { AccessRule, ActiveMembership, ActiveMembershipRejection, ActiveMembershipResult, AgentExposure, AgentHandlerHints, AgentRisk, AggregateStreamHandle, AppContext, AppendEventArgs, AppendEventFn, AuthClaimsContext, AuthClaimsFn, AuthClaimsHookDef, BeforeTransactionPhase, BeforeTransactionResult, CamelToKebab, ChatSendFailureCode, ClaimKeyDefinition, ClaimKeyHandle, ClaimKeyJsType, ClaimKeyType, DeclarativeEventMigration, DeliveryErrorCode, DeliveryFailureCode, DeliverySkipReason, DispatchWriteRef, EntityRef, EscapeHatchAuditSink, EscapeHatchDeclaration, EscapeHatchKind, EscapeHatchReporter, EscapeHatchTarget, EscapeHatchUseEvent, EventDef, EventMigrationDef, EventPiiFields, EventPiiStance, EventUpcastCtx, EventUpcastFn, FetchForWritingArgs, HandlerContext, HandlerRef, JobContext, JobRunnerRef, JobTriggerEvent, MemberReader, NameOrRef, NotifyDeferred, NotifyDelivery, NotifyDeliveryStatus, NotifyDispatched, NotifyFactory, NotifyFn, NotifyJobDispatcher, NotifyOptions, NotifyPriority, NotifyResult, OpenToAllAccessRule, OpenToAllDeclaration, OpenToAllPersonalData, PayloadBucketNormalization, PayloadRateLimitOption, PreparedWriteEvent, QualifiedEventName, QueryEvent, QueryHandlerDef, QueryHandlerFn, RateLimitDeclaration, RateLimitDisabled, RateLimitOption, RateLimitOptions, RateLimitPer, RoleAccessPersonalData, RoleAccessRule, SessionUser, SessionUserOrigin, StreamHandlerDef, StreamHandlerFn, TenantWriteTarget, TryAppendEventFn, TryAppendEventResult, UnsafeAppendEventFn, WriteEvent, WriteHandlerDef, WriteHandlerFn, WriteResult, } from "@cosmicdrift/kumiko-types/handlers";
+export type { AccessRule, ActiveMembership, ActiveMembershipRejection, ActiveMembershipResult, AgentExposure, AgentHandlerHints, AgentRisk, AggregateStreamHandle, AppContext, AppendEventArgs, AppendEventFn, AuthClaimsContext, AuthClaimsFn, AuthClaimsHookDef, BeforeTransactionPhase, BeforeTransactionResult, CamelToKebab, ChatSendFailureCode, ClaimKeyDefinition, ClaimKeyHandle, ClaimKeyJsType, ClaimKeyType, DeclarativeEventMigration, DeliveryErrorCode, DeliveryFailureCode, DeliverySkipReason, DispatchWriteRef, EntityRef, EscapeHatchAuditSink, EscapeHatchDeclaration, EscapeHatchKind, EscapeHatchReporter, EscapeHatchTarget, EscapeHatchUseEvent, EventDef, EventMigrationDef, EventPiiFields, EventPiiStance, EventUpcastCtx, EventUpcastFn, FetchForWritingArgs, HandlerContext, HandlerRef, JobContext, JobRunnerRef, JobTriggerEvent, MemberReader, NameOrRef, NotifyDeferred, NotifyDelivery, NotifyDeliveryStatus, NotifyDispatched, NotifyFactory, NotifyFn, NotifyJobDispatcher, NotifyOptions, NotifyPriority, NotifyResult, OpenToAllAccessRule, OpenToAllDeclaration, OpenToAllPersonalData, PayloadBucketNormalization, PayloadRateLimitOption, PreparedWriteEvent, ProviderPluginContext, QualifiedEventName, QueryEvent, QueryHandlerDef, QueryHandlerFn, RateLimitDeclaration, RateLimitDisabled, RateLimitOption, RateLimitOptions, RateLimitPer, RoleAccessPersonalData, RoleAccessRule, SessionUser, SessionUserOrigin, StreamHandlerDef, StreamHandlerFn, TenantWriteTarget, TryAppendEventFn, TryAppendEventResult, UnsafeAppendEventFn, WriteEvent, WriteHandlerDef, WriteHandlerFn, WriteResult, } from "@cosmicdrift/kumiko-types/handlers";
 export { DELIVERY_FAILURE_CODES, DELIVERY_SKIP_REASONS, declaredRateLimitOptions, HTTP_ERROR_CODE_PATTERN, isDeliveryErrorCode, isOpenToAllGranted, isRateLimitDisabled, isRateLimitOption, isUiAccessGranted, } from "@cosmicdrift/kumiko-types/handlers";
 export type { DeleteContext, EntityHookMap, HookMap, HookOwner, HookPhase, LifecycleHookFn, LifecycleResult, OwnedFn, PhasedHook, PostDeleteBatchHookFn, PostDeleteHookFn, PostQueryHookFn, PostSaveBatchHookFn, PostSaveHookFn, PreDeleteHookFn, PreQueryHookFn, PreSaveHookFn, SaveContext, SearchPayloadContributorFn, ValidationError, ValidationHookFn, } from "@cosmicdrift/kumiko-types/hooks";
 export type { HttpRouteDefinition, HttpRouteHandler, HttpRouteHandlerDeps, HttpRouteMethod, } from "@cosmicdrift/kumiko-types/http-route";
@@ -17,7 +17,7 @@ export type { ContentCollectionDefinition, NavDefinition, NavIconKey, } from "@c
 export type { FromRule, FromRuleKind, OwnershipClause, OwnershipMap, OwnershipRef, OwnershipRule, SqlFragment, WhereRule, WhereRuleContext, } from "@cosmicdrift/kumiko-types/ownership";
 export type { EntityProjectionExtension, MspErrorMode, MspErrorPolicy, MultiStreamApplyFn, MultiStreamProjectionDefinition, ProjectionDefinition, ProjectionRowIdOf, ProjectionTable, SingleStreamApplyFn, } from "@cosmicdrift/kumiko-types/projection";
 export type { BelongsToRelation, EntityRelations, HasManyRelation, ManyToManyRelation, RelationDefinition, } from "@cosmicdrift/kumiko-types/relations";
-export type { ActionFormScreenDefinition, ConfigEditScreenDefinition, CustomScreenDefinition, CustomScreenRoute, DashboardChartMarkerKind, DashboardChartPanel, DashboardChartRangeOption, DashboardChartRanges, DashboardCustomPanel, DashboardDateParam, DashboardFeedPanel, DashboardFilterDefinition, DashboardI18nText, DashboardListPanel, DashboardMoneyParam, DashboardPanelDefinition, DashboardPanelGate, DashboardPanelVisibility, DashboardProgressListPanel, DashboardScreenDefinition, DashboardScreenPanel, DashboardStatGroupPanel, DashboardStatPanel, DashboardText, DashboardTextParam, DashboardValueFormat, EditExtensionSection, EditFieldPrefill, EditFieldSpec, EditFieldsSection, EditLayout, EditRelatedListSection, EditSectionSpec, EditWriteFormSection, EmbeddedListEditSpec, EntityEditAction, EntityEditActionPlacement, EntityEditScreenDefinition, EntityListExpandableRow, EntityListScreenDefinition, FieldCondition, FieldFormatRegistry, FieldRenderer, FormatSpec, FormWidth, ListColumnSpec, ListEmptyStateSpec, ListFacetSpec, ListPaginationMode, ListSortDir, ListSortSpec, MetricNavigate, MetricSpec, PlatformComponent, ProjectionDetailScreenDefinition, ProjectionListScreenDefinition, RecordHeaderSpec, RecordHeaderSubtitlePart, RowAction, RowActionNavigate, RowActionNavigateBase, RowActionWriteHandler, RowFieldExtractor, ScreenDefinition, ScreenFilter, ScreenFilterOp, ScreenNavSugar, ScreenSlots, SecretMintConfirmStep, SecretMintScreenDefinition, SecretReveal, SecretRevealField, SecretsEditScreenDefinition, SecretsEditSection, ToolbarAction, UnitKey, } from "@cosmicdrift/kumiko-types/screen";
+export type { ActionFormScreenDefinition, ConfigEditScreenDefinition, CustomScreenDefinition, CustomScreenRoute, DashboardChartMarkerKind, DashboardChartPanel, DashboardChartRangeOption, DashboardChartRanges, DashboardCurrencyFormat, DashboardCustomPanel, DashboardDateParam, DashboardFeedPanel, DashboardFilterDefinition, DashboardI18nText, DashboardListPanel, DashboardMoneyParam, DashboardPanelDefinition, DashboardPanelGate, DashboardPanelVisibility, DashboardProgressListPanel, DashboardProgressTone, DashboardRecordBinding, DashboardRefresh, DashboardRelativeTimeFormat, DashboardRelativeTimeParam, DashboardScreenDefinition, DashboardScreenPanel, DashboardStatGroupPanel, DashboardStatPanel, DashboardText, DashboardTextBlock, DashboardTextPanel, DashboardTextParam, DashboardValueFormat, EditExtensionSection, EditFieldPrefill, EditFieldSpec, EditFieldsSection, EditLayout, EditRelatedListSection, EditSectionSpec, EditWriteFormSection, EmbeddedListEditSpec, EntityEditAction, EntityEditActionPlacement, EntityEditScreenDefinition, EntityListExpandableRow, EntityListScreenDefinition, FieldCondition, FieldFormatRegistry, FieldRenderer, FormatSpec, FormWidth, ListColumnSpec, ListEmptyStateSpec, ListFacetSpec, ListPaginationMode, ListSortDir, ListSortSpec, MetricNavigate, MetricSpec, PlatformComponent, ProjectionDetailScreenDefinition, ProjectionListScreenDefinition, RecordHeaderSpec, RecordHeaderSubtitlePart, RowAction, RowActionNavigate, RowActionNavigateBase, RowActionWriteHandler, RowFieldExtractor, ScreenDefinition, ScreenFilter, ScreenFilterOp, ScreenNavSugar, ScreenSlots, SecretMintConfirmStep, SecretMintScreenDefinition, SecretReveal, SecretRevealField, SecretsEditScreenDefinition, SecretsEditSection, ToolbarAction, UnitKey, } from "@cosmicdrift/kumiko-types/screen";
 export { metricField, relatedListGroupHeaderLabel, relatedListGroupKey, } from "@cosmicdrift/kumiko-types/screen";
 export type { TargetRef } from "@cosmicdrift/kumiko-types/target-ref";
 export type { Subscribe, TreeAction, TreeActionDef, TreeActionsHandle, TreeChildrenSubscribe, TreeNode, TreeNodeState, } from "@cosmicdrift/kumiko-types/tree-node";

package/dist/env/index.js

@@ -277,7 +277,7 @@ function formatBootError(errors) {
         }
     }
     lines.push("");
-    lines.push("See: kumiko-platform/docs/runbooks/standard-deploy-app.md#step-1-boot-dry-run-lokal");
+    lines.push("See: https://github.com/CosmicDriftGameStudio/infra/blob/main/docs/runbooks/standard-deploy-app.md#schritt-1--env-vertrag-lokal-ausgeben");
     return lines.join("\n");
 }
 export class KumikoBootError extends Error {

package/dist/errors/zod-bridge.js

@@ -35,7 +35,7 @@ export function validationErrorFromZod(error) {
 // `code: "custom"` is zod's catch-all for every superRefine/refine check;
 // left mechanical it'd collapse onto one generic key, so a superRefine can
 // set `params.i18nKey` to override it. Keep in sync with the client mirror
-// (packages/headless/src/form/zod-bridge.ts).
+// (packages/renderer/src/headless/form/zod-bridge.ts).
 function resolveI18nKey(issue) {
     if (issue.code === "custom") {
         const override = issue.params?.["i18nKey"];

package/dist/files/file-ref-entity.d.ts

@@ -14,7 +14,7 @@ export declare const fileRefEntity: import("@cosmicdrift/kumiko-types/fields").E
         readonly sensitive?: boolean;
         readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
-        readonly format?: "email" | "url" | "phone" | "password";
+        readonly format?: "email" | "url" | "phone" | "password" | "month";
         readonly default?: string;
         readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
         readonly multiline?: boolean | {
@@ -37,7 +37,7 @@ export declare const fileRefEntity: import("@cosmicdrift/kumiko-types/fields").E
         readonly sensitive?: boolean;
         readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
-        readonly format?: "email" | "url" | "phone" | "password";
+        readonly format?: "email" | "url" | "phone" | "password" | "month";
         readonly default?: string;
         readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
         readonly multiline?: boolean | {
@@ -60,7 +60,7 @@ export declare const fileRefEntity: import("@cosmicdrift/kumiko-types/fields").E
         readonly sensitive?: boolean;
         readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
-        readonly format?: "email" | "url" | "phone" | "password";
+        readonly format?: "email" | "url" | "phone" | "password" | "month";
         readonly default?: string;
         readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
         readonly multiline?: boolean | {
@@ -95,7 +95,7 @@ export declare const fileRefEntity: import("@cosmicdrift/kumiko-types/fields").E
         readonly sensitive?: boolean;
         readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
-        readonly format?: "email" | "url" | "phone" | "password";
+        readonly format?: "email" | "url" | "phone" | "password" | "month";
         readonly default?: string;
         readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
         readonly multiline?: boolean | {
@@ -118,7 +118,7 @@ export declare const fileRefEntity: import("@cosmicdrift/kumiko-types/fields").E
         readonly sensitive?: boolean;
         readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
-        readonly format?: "email" | "url" | "phone" | "password";
+        readonly format?: "email" | "url" | "phone" | "password" | "month";
         readonly default?: string;
         readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
         readonly multiline?: boolean | {
@@ -141,7 +141,7 @@ export declare const fileRefEntity: import("@cosmicdrift/kumiko-types/fields").E
         readonly sensitive?: boolean;
         readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
-        readonly format?: "email" | "url" | "phone" | "password";
+        readonly format?: "email" | "url" | "phone" | "password" | "month";
         readonly default?: string;
         readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
         readonly multiline?: boolean | {

package/dist/files/file-ref-table.d.ts

@@ -13,7 +13,7 @@ export declare const fileRefsTable: import("../db/table-builder.ts").EntityTable
         readonly sensitive?: boolean;
         readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
-        readonly format?: "email" | "url" | "phone" | "password";
+        readonly format?: "email" | "url" | "phone" | "password" | "month";
         readonly default?: string;
         readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
         readonly multiline?: boolean | {
@@ -36,7 +36,7 @@ export declare const fileRefsTable: import("../db/table-builder.ts").EntityTable
         readonly sensitive?: boolean;
         readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
-        readonly format?: "email" | "url" | "phone" | "password";
+        readonly format?: "email" | "url" | "phone" | "password" | "month";
         readonly default?: string;
         readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
         readonly multiline?: boolean | {
@@ -59,7 +59,7 @@ export declare const fileRefsTable: import("../db/table-builder.ts").EntityTable
         readonly sensitive?: boolean;
         readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
-        readonly format?: "email" | "url" | "phone" | "password";
+        readonly format?: "email" | "url" | "phone" | "password" | "month";
         readonly default?: string;
         readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
         readonly multiline?: boolean | {
@@ -94,7 +94,7 @@ export declare const fileRefsTable: import("../db/table-builder.ts").EntityTable
         readonly sensitive?: boolean;
         readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
-        readonly format?: "email" | "url" | "phone" | "password";
+        readonly format?: "email" | "url" | "phone" | "password" | "month";
         readonly default?: string;
         readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
         readonly multiline?: boolean | {
@@ -117,7 +117,7 @@ export declare const fileRefsTable: import("../db/table-builder.ts").EntityTable
         readonly sensitive?: boolean;
         readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
-        readonly format?: "email" | "url" | "phone" | "password";
+        readonly format?: "email" | "url" | "phone" | "password" | "month";
         readonly default?: string;
         readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
         readonly multiline?: boolean | {
@@ -140,7 +140,7 @@ export declare const fileRefsTable: import("../db/table-builder.ts").EntityTable
         readonly sensitive?: boolean;
         readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
-        readonly format?: "email" | "url" | "phone" | "password";
+        readonly format?: "email" | "url" | "phone" | "password" | "month";
         readonly default?: string;
         readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
         readonly multiline?: boolean | {

package/dist/files/index.d.ts

@@ -5,7 +5,7 @@ export { createFileRefFromBytes, createFileRefFromUploadedBytes, uploadFileBytes
 export { createFilesFeature, FILES_FEATURE } from "./feature.ts";
 export type { FileContext, FileHandle } from "./file-handle.ts";
 export { createFileContext, createTenantFileContext, deriveKey, storageKeyStemPrefix, } from "./file-handle.ts";
-export { fileRefEntity } from "./file-ref-entity.ts";
+export { FILE_REF_ENTITY_NAME, fileRefEntity } from "./file-ref-entity.ts";
 export { fileRefsTable } from "./file-ref-table.ts";
 export type { FileAccessDecision, FileAccessGuard, FileRef, FileRoutesOptions, } from "./file-routes.ts";
 export { createFileRoutes, readFilesRouteOptions, resolveMaxUploadBodyBytes, } from "./file-routes.ts";

package/dist/files/index.js

@@ -4,7 +4,7 @@ export { createFilesFeature, FILES_FEATURE } from "./feature.js";
 // `createFileHandle` is an implementation detail — construct handles via
 // `createFileContext(provider).ref(key)`, which is the AppContext surface.
 export { createFileContext, createTenantFileContext, deriveKey, storageKeyStemPrefix, } from "./file-handle.js";
-export { fileRefEntity } from "./file-ref-entity.js";
+export { FILE_REF_ENTITY_NAME, fileRefEntity } from "./file-ref-entity.js";
 export { fileRefsTable } from "./file-ref-table.js";
 export { createFileRoutes, readFilesRouteOptions, resolveMaxUploadBodyBytes, } from "./file-routes.js";
 export { createInMemoryFileProvider } from "./in-memory-provider.js";

package/dist/files/provider-resolver.d.ts

@@ -6,30 +6,30 @@ import type { ConfigAccessor, ConfigAccessorFactory, Registry } from "../engine/
 import type { SecretsContext } from "../secrets/index.ts";
 import type { FileStorageProvider } from "./types.ts";
 /**
- * Schmaler Surface-Type fuer Provider-Plugins. HandlerContext ist zu fett
- * (haelt tx, actor, signal etc.) — Provider sollen sich auf die read-Felder
- * beschraenken die fuer Tenant-Config + Secret-Lookup gebraucht werden.
+ * Narrow surface type for provider plugins. HandlerContext carries tx, actor,
+ * signal and more; providers only get the read fields needed for tenant config
+ * and secret lookup.
  *
- * **Warum nicht voller HandlerContext?** Im Worker-Pfad (r.job) gibt es keinen
- * request-bezogenen `tx`/`actor`/`signal`. Wenn ein Provider `ctx.tx` lesen
- * wuerde, wuerde der ganze Worker-Pfad zur Runtime brechen — und das wuerde NUR
- * mit S3 und nur in production auffallen. Die schmale Surface zwingt Provider
- * zur expliziten Erweiterung statt silent ctx-feld-ausnutzen.
+ * **Why not the full HandlerContext?** On the worker path (r.job) there is no
+ * request-bound `tx`/`actor`/`signal`. A provider reading `ctx.tx` would break
+ * the whole worker path at runtime, and that would only show up with S3 in
+ * production. The narrow surface forces providers to extend it explicitly
+ * instead of quietly relying on extra ctx fields.
  *
- * **Felder:**
- *   config  — fuer tenant-config-reads (bucket/region/endpoint/...)
- *   registry — fuer extension-Lookup in der Factory (nicht Plugin-intern)
- *   secrets — fuer tenant-secret-reads (s3.secretAccessKey)
- *   _userId — Audit-/Authority-Identity fuer secret-reads. Der Framework-
- *             Resolver setzt das auf SYSTEM_USER_ID — der s3-Provider liest
- *             `s3.secretAccessKey`, was Nicht-Admin-Request-User nicht duerfen;
- *             die Request-User-Autorisierung bleibt am Route-accessGuard.
+ * **Fields:**
+ *   config      — tenant config reads (bucket/region/endpoint/...)
+ *   registry    — extension lookup in the factory (not plugin-internal)
+ *   secrets     — tenant secret reads (s3.secretAccessKey)
+ *   auditUserId — audit and authority identity for secret reads. The framework
+ *                 resolver sets SYSTEM_USER_ID because the s3 provider reads
+ *                 `s3.secretAccessKey`, which non-admin request users may not;
+ *                 request-user authorization stays on the route accessGuard.
  */
 export type FileProviderContext = {
     readonly config?: ConfigAccessor;
     readonly registry?: Registry;
     readonly secrets?: SecretsContext;
-    readonly _userId?: string | undefined;
+    readonly auditUserId?: string | undefined;
 };
 /**
  * File-Storage-Plugin contract. Each provider-feature (file-provider-s3,